Path Traversal Vulnerability in ZeroClaw by ZeroClaw Labs
CVE-2026-101885

8.5HIGH

Key Information:

Vendor

Zeroclaw-labs

Status
Zeroclaw
Vendor
CVE Published:
30 September 2026

What is CVE-2026-101885?

ZeroClaw versions before 0.8.5 feature a path traversal vulnerability stemming from improper validation of the wasm_path manifest field during plugin installation. This flaw allows attackers to induce users into installing malicious plugins that can write arbitrary files to unintended system paths, including sensitive shell startup files, thus potentially enabling remote code execution.

Affected Version(s)

ZeroClaw 0 < 0.8.5

References

https://github.com/zeroclaw-labs/zeroclaw/security/adviso...
vendor-advisory
https://github.com/zeroclaw-labs/zeroclaw/commit/432e034d...
patch
https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0...
release-notes

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cameron Beeley (anagnorisis2peripeteia)
.